User Guide

This guide covers what an analyst does on a sos-vault appliance after the operator has provisioned their account. If you are the operator, start with the Administration Guide instead.

Signing in

Open https://<your-appliance>/ and sign in with the email your operator gave you. Until the operator replaces the installer's self-signed certificate you will see a browser warning — that is normal, and once a real cert is installed it will go away.

Uploading an SOS report

1. From the home page, click Upload SOS report.
2. Select the sosreport-*.tar.xz file produced on the source system.
3. Choose the team / vault the report belongs to. The dropdown only shows teams you are a member of.
4. Submit. The appliance verifies the archive, extracts machine tokens, and ingests the case into the vault. Large reports take a minute or two; progress is reported inline.

Browsing a case

Open the vault from the sidebar. Each case lists its uploaded sosreport plus all decrypted artifacts (logs, config, sosreport sections). Click a node to expand it; right-click for the per-file actions (download, view raw, verify checksum).

Vault open and close

Each vault has an "open" state that holds decrypted files in memory-backed storage. Vaults auto-close after a configurable inactivity period; analysts can also force-close from the vault header. Closing scrubs the decrypted view; reopening prompts for the vault passphrase if the vault is not set to always open.

View Fleet (system history)

View Fleet in the sidebar shows one row per system instead of per case: hostname, machine-id, OS, how many reports it has uploaded, and when it was first and last seen. Clicking a system opens its report timeline with shortcuts to browse, summarize, or compare any two reports of that host — useful for change tracking, configuration drift, and capacity trends.

Systems are identified by the /etc/machine-id found inside each report, so reports keep grouping correctly even when sos report --clean obfuscated the hostname. Two caveats: if the obfuscation mapping is not preserved between runs on the source system, one host may appear as several rows; and cloned VMs that share a machine-id collapse into one row. The extracted identity (machine-id, hostname) is stored in the appliance database outside the encrypted vault so the fleet list works without opening vaults — report contents stay encrypted.

Reports uploaded before this feature carry no identity yet. They backfill automatically when a case is opened in the browser, or the operator can run php artisan fleet:backfill-identity in bulk while vaults are open.

Modules

The Customer Portal hosts optional modules (e.g. german-support, add-on analysers). Operator-installed modules surface in the analyser ribbon once enabled.

What gets logged

The appliance writes structured logs locally only. Nothing about your case data leaves the appliance.